Microsoft Deep Dive Solorigate January 2021

During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.

TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.

During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.

TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.

Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.

Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.

Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.

SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.

Raindrop was installed under names that resembled legitimate Windows file and directory names.

TEARDROP files had names that resembled legitimate Window file and directory names.

During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.

SUNBURST used VBScripts to initiate the execution of payloads.

SUNBURST removed HTTP proxy registry values to clean up traces of execution.

During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.

SUNBURST also removed the firewall rules it created during execution.

SUNBURST removed IFEO registry values to clean up traces of persistence.

SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.

Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.

TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.

During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.

During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.

SUNBURST used Rundll32 to execute payloads.

During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.

During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.

SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.

During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.

During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

During the SolarWinds Compromise, APT29 used `fsutil` to check available free space before executing actions that might create large files on disk.

During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.

During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.

During the SolarWinds Compromise, APT29 used `netsh` to configure firewall rules that limited certain UDP outbound packets.